4

In 2014, the New Zealand Internet Task Force released a set of guidelines for Vulnerability Disclosure: http://www.nzitf.org.nz/pdf/NZITF_Disclosure_Guidelines_2014.pdf

Part of the recommendations for site owners is the publication of a disclosure policy, in a public area, to state the company's position in terms of reaction to security researchers. I drafted a Vulnerability Disclosure Policy based on the New Zealand Registry Services' policy here: https://nzrs.net.nz/about/vulnerability-disclosure-policy

My employer is in retail, and the managing director doesn't want to publish this on the website, for fear of frightening customers off our website. As a partial solution, we agreed to insert references to the document as comments in our website's source code, as well as in the HTTP headers on our webserver.

Are these enough? Are there any other places we should publish which won't be visible to our average visitor, but WILL be visible to those who should see this policy?

Improve this question
5
  • I don't recall which rfc recommends it, but domain.com/security is a good place to publish information.
    – wireghoul
    May 18, 2015 at 3:54
  • Post am email address somewhere for security related questions. Most emails will be support questions but it'll give contact info to those who need it. Just forward the support emails to support.
    – Neil Smithline
    May 18, 2015 at 4:21
  • "the managing director doesn't want to publish this on the website for fear of frighting customers off our website". Depending on the customers, it might earn you more trust if you are open to the vulnerability disclosures. For a long period of time, all the big vendors were afraid for the exact same reason. But at the end they have to embrace this.
    – void_in
    May 18, 2015 at 4:29
  • @void_in - yeah, I had that discussion :) Though we do tend towards the "better to not mention it" camp of customers. Generally not tech-savvy, to the point that admitting a possibility of vulnerability would be tantamount to a declaration of utter insecurity. :/
    – Rhyven
    May 18, 2015 at 4:34
  • Since you asked for 'hidden' areas, I would suggest considering robots.txt and humans.txt.
    – amccormack
    May 20, 2015 at 22:39

1 Answer 1

Reset to default
0

In seeking an answer to this question, I approached the team at the CROW lab (Cybersecurity Researchers of Waikato). A representative of the Lab responded with the following:

If someone does find a vulnerability, chances are they would be a tech savvy person who would have looked at the HTML or HTTP headers. I believe that it is enough for an average security researcher to find (looking at it from a technical view not legal view of course).

So, until any further information comes to light, I'm accepting that as the answer; I'll still appreciate additional answers though!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .